Domains, credits, and the calling key. Paths are under https://www.valiqai.com/api/v1; see the API overview for keys and scopes.

`GET /domains`

Your domains, newest first. Scope read.

JSON

{
  "domains": [
    {
      "id": "cmvf9…",
      "domain": "example.com",
      "label": null,
      "verified": true,
      "verifiedAt": "2026-10-12T08:00:00.000Z",
      "lastCheckedAt": "2026-10-19T08:00:00.000Z",
      "needsRecheck": false,
      "txtName": "_valiq-site-verification",
      "txtRecord": "valiq-site-verification=cmvf…"
    }
  ]
}

needsRecheck is true for a verified domain last checked 7 or more days ago.
The TXT record goes at _valiq-site-verification.<domain>.
For a team key, the list also has the domains teammates verified, marked fromTeammate: true and without the record. The key can scan them but not change them.

`POST /domains`

Adds a domain to verify, and returns the TXT record to add. Scope domains, which only personal keys have: domains belong to a person.

JSON

{ "domain": "example.com", "label": "Main site" }

201 with { "domain": { … } } for a new domain, or 200 with alreadyExists: true when you'd added it before. The domain is lowercased, and a protocol or path is dropped.

Status	`error`
400	`domain is required`
400	`Invalid domain. Provide a bare hostname like "myapp.com".`
400	`Private or reserved domains cannot be verified.`
400	`We couldn't find <domain>. Check the spelling and try again.`
403	`A team key can’t change domains; they belong to a person. Use a personal key or valiqai login.`
429	`You can verify at most 20 domains.`

`POST /domains/{id}/verify`

Looks for the TXT record now. Scope domains. A domain is checked at most once every 30 seconds; sooner answers 429 Please wait <n>s before checking again. with Retry-After.

JSON

{ "verified": true, "message": "Domain verified successfully!", "domain": { … } }

When the record isn't there yet, verified is false and message says why, like TXT record not found yet. DNS changes can take 5 min – 48 hours to propagate. A verified domain whose record has gone is unverified, and scans of it are refused until it's back.

`DELETE /domains/{id}`

Removes a domain. Scope domains. Scans of it are refused after. Answers { "ok": true }, or 404 Domain not found.

`GET /credits`

The workspace's credits, and what each scan type reserves. Scope read. A personal key in several workspaces names one with ?organizationId=.

JSON

{
  "workspace": { "id": "org_8f2…", "name": "Northstar", "kind": "team" },
  "available": 140,
  "held": 12,
  "freeEligible": false,
  "prices": {
    "e2e": { "hold": 2, "typicalMin": 1, "typicalMax": 1 },
    "security": { "hold": 12, "typicalMin": 3, "typicalMax": 6 }
  },
  "billingUrl": "https://www.valiqai.com/org/org_8f2…/billing/credits"
}

held is what running scans have reserved. freeEligible is true while you haven't used your free End-to-End scan.

`GET /me`

The calling key, the person it acts as, and its workspace. No scope needed: it's how a client checks a key.

JSON

{
  "user": { "name": "Maya Chen", "email": "maya@northstar.app" },
  "workspace": { "id": "org_8f2…", "slug": "northstar", "name": "Northstar", "kind": "team" },
  "key": { "name": "GitHub Actions", "prefix": "valiqai_3f9c", "permissions": ["scan", "read"], "expiresAt": "2027-01-18T12:00:00.000Z", "createdAt": "2026-10-20T12:00:00.000Z", "source": null }
}

`DELETE /me`

The calling key revokes itself, and answers { "revoked": true }. valiqai logout uses it, so signing out leaves no working key behind.